CVE-2026-111613: Missing Authentication for Critical Function in alldatacenter alldata

CVE-2026-111613 describes a missing authentication vulnerability in AllData (<=0.7.1) that enables remote attackers to inject JDBC connection parameters unauthenticated through the data-dts /jobJdbcDatasource/test endpoint. By supplying a malicious MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server, attackers can read arbitrary files from the host system. This vulnerability arises from the lack of authentication on a critical function that accepts JDBC connection details, allowing unauthorized database connections and file access.

The vulnerability allows unauthenticated remote attackers to open arbitrary database connections and read arbitrary files on the host system, potentially exposing sensitive data. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, no required privileges or user interaction, and high confidentiality impact. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the /jobJdbcDatasource/test endpoint and implement network-level controls to prevent unauthorized access. Monitor for unusual JDBC connection attempts and consider disabling or securing the vulnerable endpoint if possible.